General
-
Target
323b8534996ed1f42e206831aa00b77c91f20e428263b1534a1db3c2abab4915
-
Size
424KB
-
Sample
221022-mq39hscfej
-
MD5
a2801a0ac7d6204ec19ec708228e5a0b
-
SHA1
692a926583bcf3aed9fa28678435b6d7921e49ab
-
SHA256
323b8534996ed1f42e206831aa00b77c91f20e428263b1534a1db3c2abab4915
-
SHA512
b62f40f4ef79a4538afa609a0e66838339c1e54e3340d917fbf2ac7e59d6b7487b4807a1f18088736963b4030c0f28de8c43b6bfc2ddd7d72235cc3a6ea05190
-
SSDEEP
6144:tgqUTWoodwYn0vpNnjB6SZk+L6gmo/b7EqAAwp8oXbftChXW3AxfulDGgB:DUTRoKN7nt6S2+LN/AqgpZblCJxfS6
Static task
static1
Behavioral task
behavioral1
Sample
323b8534996ed1f42e206831aa00b77c91f20e428263b1534a1db3c2abab4915.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
323b8534996ed1f42e206831aa00b77c91f20e428263b1534a1db3c2abab4915.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2891029575-1462575-1165213807-1000\_RECoVERY_+hvmrl.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/512376AAEA8267
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/512376AAEA8267
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/512376AAEA8267
http://xlowfznrg4wf7dli.ONION/512376AAEA8267
Targets
-
-
Target
323b8534996ed1f42e206831aa00b77c91f20e428263b1534a1db3c2abab4915
-
Size
424KB
-
MD5
a2801a0ac7d6204ec19ec708228e5a0b
-
SHA1
692a926583bcf3aed9fa28678435b6d7921e49ab
-
SHA256
323b8534996ed1f42e206831aa00b77c91f20e428263b1534a1db3c2abab4915
-
SHA512
b62f40f4ef79a4538afa609a0e66838339c1e54e3340d917fbf2ac7e59d6b7487b4807a1f18088736963b4030c0f28de8c43b6bfc2ddd7d72235cc3a6ea05190
-
SSDEEP
6144:tgqUTWoodwYn0vpNnjB6SZk+L6gmo/b7EqAAwp8oXbftChXW3AxfulDGgB:DUTRoKN7nt6S2+LN/AqgpZblCJxfS6
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-